chore(deps): patch the audited advisories and prepare the fastify release

.changeset/bump-types-to-0-4.md

@@ -0,0 +1,14 @@
+---
+"@seamless-auth/core": patch
+---
+
+Take `@seamless-auth/types` 0.4.0.
+
+That release adds a `z.infer` alias for each of the 43 exported schemas that
+lacked one, so the naming convention now covers all 123. It is additive: no
+existing export changed name or shape, and nothing core imports from the package
+moved. Core keeps importing the same type names it always has.
+
+Adopters who resolve `@seamless-auth/types` through core pick up the new aliases
+and can name a response body without adding a direct `zod` dependency to call
+`z.infer` themselves.

AGENTS.md

@@ -13,6 +13,7 @@ Published packages:
 
 - `@seamless-auth/core` (`packages/core`): framework-agnostic core.
 - `@seamless-auth/express` (`packages/express`): the Express adapter.
+- `@seamless-auth/fastify` (`packages/fastify`): the Fastify adapter.
 
 These are public, adopter-facing packages. Their public API is a contract, and
 they bridge cookie sessions to the Bearer/JWKS contract of the
@@ -66,15 +67,16 @@ guidance may extend them but must not contradict them.
 
 - pnpm workspace (`pnpm-workspace.yaml`) with packages under `packages/*`.
 - TypeScript libraries built and published via Changesets.
-- `@seamless-auth/express` depends on `@seamless-auth/core`; keep the core free
-  of framework-specific code.
+- `@seamless-auth/express` and `@seamless-auth/fastify` depend on
+  `@seamless-auth/core`; keep the core free of framework-specific code.
 
 ## Architecture Map
 
 ```text
 packages/
   core/       framework-agnostic auth core and shared logic
   express/    Express adapter built on top of core
+  fastify/    Fastify adapter built on top of core
 ```
 
 - Keep framework specifics in the adapter package, not in `core`.

package.json

@@ -19,5 +19,16 @@
   },
   "devDependencies": {
     "@changesets/cli": "^2.29.7"
+  },
+  "pnpm": {
+    "overrides": {
+      "@babel/core": "^7.29.7",
+      "body-parser": "^2.3.0",
+      "brace-expansion@1": "^1.1.17",
+      "esbuild": "^0.28.1",
+      "form-data": "^4.0.6",
+      "js-yaml@3": "^3.15.0",
+      "js-yaml@4": "^4.3.0"
+    }
   }
 }

packages/core/SECURITY.md

@@ -32,6 +32,7 @@ This policy applies to:
 
 - @seamless-auth/core
 - @seamless-auth/express
+- @seamless-auth/fastify
 - @seamless-auth/react
 - Seamless Auth Server
 - Official Docker images published under the Seamless Auth organization

packages/core/package.json

@@ -52,7 +52,7 @@
         "test:watch": "pnpm run build && NODE_OPTIONS=--experimental-vm-modules jest --watch"
     },
     "dependencies": {
-        "@seamless-auth/types": "^0.3.0",
+        "@seamless-auth/types": "^0.4.0",
         "jose": "^6.1.3",
         "jsonwebtoken": "^9.0.2"
     },

packages/fastify/CONTRIBUTING.md

@@ -0,0 +1,127 @@
+# Contributing to Seamless Auth
+
+Thanks for your interest in contributing to Seamless Auth.
+Contributions of all kinds are welcome: bug reports, documentation improvements, tests, and code.
+
+---
+
+## Project Philosophy
+
+Seamless Auth is built around a few core principles:
+
+- **Security first**: explicit trust boundaries and auditable logic
+- **Framework-agnostic core**: adapters should be thin
+- **Minimal magic**: clear inputs and outputs
+- **Predictable behavior**: changes should not surprise users
+
+Please keep these principles in mind when contributing.
+
+---
+
+## Ways to Contribute
+
+You can help by:
+
+- Reporting bugs
+- Improving documentation
+- Adding tests
+- Refactoring for clarity
+- Building new adapters (Fastify, Next.js, etc.)
+
+If you’re unsure where to start, open a discussion or issue.
+
+---
+
+## Development Setup
+
+Clone the repository:
+
+    git clone https://github.com/fells-code/seamless-auth-server.git
+    cd seamless-auth-server
+
+Install dependencies:
+
+    npm install
+
+Build packages:
+
+    npm run build
+
+Run tests:
+
+    npm test
+
+Some packages may require additional environment variables. Refer to their individual README files for details.
+
+---
+
+## Code Style
+
+- TypeScript is used throughout
+- ESM modules (`"type": "module"`)
+- Prefer explicit types over `any`
+- Avoid hidden side effects and implicit globals
+- Keep adapters thin; put logic in `@seamless-auth/core`
+
+Formatting and linting tools are provided, please run them before submitting a PR.
+
+---
+
+## Testing Requirements
+
+All changes that affect behavior should include tests.
+
+Guidelines:
+
+- Core logic should be tested in `@seamless-auth/core`
+- Adapters should use smoke or integration tests
+- Tests should run against compiled output where applicable
+
+Pull requests with failing tests will not be merged.
+
+---
+
+## Commit Guidelines
+
+Please use clear, descriptive commit messages.
+
+Examples:
+
+- feat: add role-based authorization middleware
+- fix: prevent refresh loop on expired cookie
+- docs: clarify express adapter setup
+- test: add coverage for ensureCookies refresh path
+
+---
+
+## Submitting a Pull Request
+
+1. Fork the repository
+2. Create a feature branch
+3. Make your changes
+4. Add or update tests as needed
+5. Ensure all checks pass
+6. Open a pull request with a clear description
+
+Large or breaking changes should be discussed before implementation.
+
+---
+
+## Security Issues
+
+If you discover a security vulnerability, **do not** open a public issue.
+
+Instead, see `SECURITY.md` for responsible disclosure instructions.
+
+---
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the same license as the project (AGPL-3.0-only unless otherwise stated).
+
+---
+
+Thank you for helping improve Seamless Auth.
+
+Fells Code, LLC
+https://seamlessauth.com

packages/fastify/SECURITY.md

@@ -0,0 +1,77 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Seamless Auth takes security seriously.
+We appreciate responsible disclosure and will work quickly with researchers and users to investigate and resolve issues.
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+---
+
+## How to Report
+
+If you believe you have found a security vulnerability, please report it privately by emailing:
+
+security@seamlessauth.com
+
+Include as much detail as possible:
+
+- A clear description of the issue
+- Steps to reproduce (proof-of-concept if available)
+- Affected package(s) and version(s)
+- Potential impact (authentication bypass, privilege escalation, data exposure, etc.)
+
+Encrypted reports are welcome. If you need a public PGP key, request one in your initial email.
+
+---
+
+## Scope
+
+This policy applies to:
+
+- Repositories published under the Fells Code organization
+- All artifacts produced directly or indirectly under the Fells Code organization
+- Official Docker images published under the Fells Code organization
+
+Third-party dependencies are not covered, but reports identifying vulnerable dependency usage are appreciated.
+
+---
+
+## What to Expect
+
+- **Acknowledgement** within 72 hours
+- **Initial assessment** within 5 business days
+- **Fix or mitigation** as quickly as possible depending on severity
+
+We will coordinate disclosure timing with you if a fix requires public communication.
+
+---
+
+## Supported Versions
+
+Security fixes are applied to:
+
+- The latest published version
+- The current development branch
+
+Older versions may not receive patches unless the issue is critical.
+
+---
+
+## Responsible Disclosure
+
+We kindly ask that you:
+
+- Allow reasonable time to investigate and remediate
+- Avoid exploiting vulnerabilities beyond proof-of-concept
+- Avoid public disclosure until a fix is released or coordinated
+
+We believe responsible disclosure helps keep the ecosystem safer for everyone.
+
+---
+
+Thank you for helping keep Seamless Auth secure.
+
+Fells Code, LLC  
+https://seamlessauth.com